Overview

overview

10

Static

static

3

ef2c38594f...18.exe

windows7-x64

10

ef2c38594f...18.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

jdiqrg82pzye5z.dll

windows7-x64

3

jdiqrg82pzye5z.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ef2c38594f17cccbebb0bb3552caccb4_JaffaCakes118

  • Size

    241KB

  • Sample

    240921-ggypsaxeld

  • MD5

    ef2c38594f17cccbebb0bb3552caccb4

  • SHA1

    de841758e2b10290e519b3629d3b2f97acb3d135

  • SHA256

    8a59bb0e1678af1df0b5d32e17ecc543310876b8b27ed18350ffced305ac32bd

  • SHA512

    5617b1bf9ad9ab97d0668b1254b65e6d54ccfcca9c4a05fe5479d60533ee23bd32eefda9c607e6650d4dbfac7b5f1f27be33acb60832b25a39584963ee6d6ed5

  • SSDEEP

    6144:Vx/MeWig4JNHT9F40FDostSmg8+NJbnwiRWBUYTE:LC3ONHTxFDFgFzVRQUj

Score
10/10
remcosmoney-logsdiscoveryrat

Malware Config

Extracted

Family

remcos

Version

2.7.2 Pro

Botnet

MONEY-LOGS

C2

103.153.76.111:2667

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    EXCEL.exe

  • copy_folder

    EXCEL

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    EXCEL

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    EXCEL-T1QMJO

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    EXCEL

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Targets

    • Target

      ef2c38594f17cccbebb0bb3552caccb4_JaffaCakes118

    • Size

      241KB

    • MD5

      ef2c38594f17cccbebb0bb3552caccb4

    • SHA1

      de841758e2b10290e519b3629d3b2f97acb3d135

    • SHA256

      8a59bb0e1678af1df0b5d32e17ecc543310876b8b27ed18350ffced305ac32bd

    • SHA512

      5617b1bf9ad9ab97d0668b1254b65e6d54ccfcca9c4a05fe5479d60533ee23bd32eefda9c607e6650d4dbfac7b5f1f27be33acb60832b25a39584963ee6d6ed5

    • SSDEEP

      6144:Vx/MeWig4JNHT9F40FDostSmg8+NJbnwiRWBUYTE:LC3ONHTxFDFgFzVRQUj

    Score
    10/10
    remcosmoney-logsdiscoveryrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      fccff8cb7a1067e23fd2e2b63971a8e1

    • SHA1

      30e2a9e137c1223a78a0f7b0bf96a1c361976d91

    • SHA256

      6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

    • SHA512

      f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

    • SSDEEP

      192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      jdiqrg82pzye5z.dll

    • Size

      21KB

    • MD5

      aadaaa353372e70ccfe4d4f4c1bbd1f7

    • SHA1

      54d48dd123c7ec8b61e35044b77520cee3b4d448

    • SHA256

      75591a435b4d7f1ad7ade1a931219529d86a1f66944e3dced39c361f0a8f6321

    • SHA512

      5af3ea7e9ddb43322322fcba69bc21b959481f1962a3a47b46b9ce38f716c1fe47a57204f0bd0a4c0bf9de1ffc60b0db43b95cb3129afa85c3c6837e3f21fb9b

    • SSDEEP

      384:q4D9QMdvZx94X20ZJ5gbs1Ww2nhd5HXG9PwcFEfC9lCRofPXaKn:q3O4G0Hm02nX5H5a9lzXaY

    Score
    3/10
    discovery
    behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Tasks